OXPUS.de

I find this problem:

if I put this URL

http://www.proalcool.it/phpBB2/download ... b_users%23

where www.proalcool.it/phpBB2/downloads.php?cat=2 is one of the category page, I obtain the list of all members with correspondents e-mail and cripted passwords.

Is this a BUG? Why this page permit this operation on the Sql DB?
Can I forbid this operation?

Sorry for my poor english but I'm italian... 8)

Bye,
Maury